Description

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide. For more information see REST Run Playbook (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/run-playbook-endpoints/rest-run-playbook) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:22.023Z",
  "pubdate": "2026-08-19T22:17:22.023Z",
  "executiveSummary": "An information disclosure vulnerability affects Splunk SOAR in versions below 8.6.0, involving the Representational State Transfer (REST) API filtering mechanism on playbook runs.\nThe vulnerability allows an authenticated user with a valid Splunk SOAR account to leverage REST API filtering to successfully recover sensitive session tokens.\nSuccessful exploitation compromises all data accessible to the affected user via the harvested session tokens.\nThe root cause stems from the application failing to properly restrict REST API filters from matching internal values that API responses are normally designed to hide.\nAttack capabilities require a valid user account to interact with the REST API and execute specific filtering queries against playbook run endpoints.\nRisk implications are severe due to unauthorized exposure of sensitive authentication credentials and complete data confidentiality compromise within the scope of the affected user's privileges.\nOrganizations utilizing vulnerable versions must apply vendor-supplied patches to remediate the underlying logic flaw in REST API filtering constraints.",
  "technicalDetails": "The vulnerability resides within the REST API handling mechanisms of Splunk SOAR for playbook runs, specifically concerning how query filters process hidden response fields.\nThe root cause is that Splunk SOAR fails to enforce validation or restriction boundaries on REST API filters, allowing them to match and retrieve values that are intentionally concealed from standard API responses.\nThe affected component is the Representational State Transfer (REST) API endpoint responsible for handling playbook execution data, documented in the REST Run Playbook reference.\nAffected software versions include all deployments of Splunk SOAR below version 8.6.0.\nAuthentication requirements dictate that the attacker must possess a valid Splunk SOAR user account to interact with the REST API.\nPrivilege requirements are constrained to standard user access, meaning high-privileged administrative accounts are not strictly required for this specific information disclosure attack vector.\nNetwork exposure involves accessibility to the Splunk SOAR REST API interface.\nThe attack flow begins when an authenticated user crafts specialized Representational State Transfer (REST) API filter queries targeting playbook run endpoints.\nBecause the filtering engine evaluates internal fields without enforcing proper redaction or masking rules for hidden data, the crafted requests iteratively probe for sensitive attributes.\nThe response payload subsequently leaks unauthorized data, specifically session tokens, which are otherwise obfuscated during normal operational usage of the API.\nPost-exploitation impact involves the utilization of the harvested session tokens to impersonate the affected user or leverage their associated access rights, resulting in a complete compromise of all data available to that user within the Splunk SOAR environment."
}